Feds: Harvard fellow hacked millions of papers

A Harvard University fellow who was studying ethics was charged with hacking into the Massachusetts Institute of Technology's computer network to steal nearly 5 million academic articles.

Aaron Swartz, 24, of Cambridge, was accused of stealing the documents from JSTOR, a popular research subscription service that offers digitized copies of more than 1,000 academic journals and documents, some dating back to the 17th century.

In an indictment released Tuesday, prosecutors say Swartz stole 4.8 million articles between September 2010 and January after breaking into a computer wiring closet on MIT's campus. Swartz, a student at the Edmond J. Safra Center for Ethics, downloaded so many documents during one October day that some of JSTOR's computer servers crashed, according to the indictment.

Swartz turned himself in Tuesday and was arraigned in U.S. District Court, where he pleaded not guilty to charges including wire fraud, computer fraud and unlawfully obtaining information from a protected computer. He was released on $100,000 unsecured bond and faces up to 35 years in prison, if convicted.

"Stealing is stealing whether you use a computer command or a crowbar, and whether you take documents, data or dollars," U.S. Attorney Carmen Ortiz said in a statement. "It is equally harmful to the victim whether you sell what you have stolen or give it away."

A call to Swartz's attorney wasn't immediately returned. Swartz is due back in court Sept. 9.

A spokeswoman for JSTOR said Tuesday that Swartz had agreed to return all the articles so the company can ensure they aren't distributed.

"We don't own any of this content. We really have to responsible stewards of it," said spokeswoman Heidi McGregor. "We worked hard to find out what was going on. We worked hard to get the data back."

Swartz is an online activist who founded the website Demand Progress, which says it "works to win progressive policy changes for ordinary people."

The site describes Swartz as "the author of numerous articles on a variety of topics, especially the corrupting influence of big money on institutions including nonprofits, the media, politics, and public opinion." It said he and another researcher once downloaded and analyzed more than 440,000 law review articles to determine their funding sources.

Demand Progress's executive director David Segal said on the website that the charges against Swartz don't make sense.

"It's like trying to put someone in jail for allegedly checking too many books out of the library," he said.

A Harvard spokesman said Swartz was placed on leave from a 10-month fellowship after the university learned about the investigation. He said the fellowship ended last month.

Swartz had legitimate access to JSTOR through Harvard, but the company has usage restrictions that would have prevented such colossal downloads.

The nonprofit JSTOR, founded in 1995, enables libraries to save space, time and labor by digitally storing centuries worth of academic journals. Its oldest publication is a Proceedings of the Royal Society of London from 1665.

Its annual subscription fees can cost a large research university as much as $50,000.

According to the indictment, Swartz connected a laptop to MIT's system in September 2010 through a basement network wiring closet and registered as a guest under the fictitious name, Gary Host, in which the first initial and last name spell "ghost." He then used a software program to "rapidly download at extraordinary volume of articles from JSTOR," according to the indictment.

In the following months, MIT and JSTOR tried to block the recurring and massive downloads, on occasion denying all MIT users access to JSTOR. But Swartz allegedly got around it, in part, by disguising the computer source of the demands for data.

In November and December, Swartz allegedly made 2 million downloads from JSTOR, 100 times the number made during the same period by all legitimate JSTOR users at MIT.

The indictment also alleges that on Jan. 6, Swartz went to the wiring closet to remove the laptop, attempting to shield his identity by holding a bike helmet in front of his face and seeing his way through its ventilation holes. It said that he fled when MIT police tried to question him that day.

An MIT spokeswoman said the school had no comment on the apparent breach.

McGregor said JSTOR recognizes it's very difficult for any institution at any level to protect its data.

"Hacking is rampant," she said. "Protecting systems is a huge challenge right now for any industry, and in the academic space it's especially challenging because we all want to be as open as we can and have policies that promote use."